Snapshot 38461
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to content Trust · Our own posture Security at CyberComply. You are trusting us with information about your firm's security posture. Here is exactly how we handle it — stated the same way we make your product state things: from what is actually in place, not what sounds good. Email our security team What we do not claim: CyberComply does not currently hold a SOC 2 report or ISO 27001 certificate, and we will not imply otherwise with badge walls. When that changes, this page will say so with the report to back it. We hold ourselves to the same no-fabrication bar our product enforces for you. What we store, and what we deliberately do not We store the security telemetry needed to run your program: external scan results, evidence records from connected integrations (rosters, configuration checks — with integrity digests), generated documents, and your program registers (people, risks, incidents, inventory, training, acknowledgments). Portal passwords are stored as salted hashes; API keys are stored as SHA-256 hashes and their plaintext is shown exactly once at creation. Integration credentials you connect are used to run your checks and can be deleted by you at any time — disconnecting an integration deletes its stored credentials immediately, not just a flag. We never ask for, and have no place to store, your clients' tax returns or SSNs. Evidence records describe control state (counts, statuses, configuration), not client tax data. How access works Customer portal sessions are signed JWTs scoped to a single firm; every portal endpoint checks the session against the tenant it addresses. Auditor links are read-only, tokenised, and expose evidence metadata and integrity digests — never underlying documents. Vendor questionnaire access is invite-bound with one-time, expiring sign-in codes delivered by email. Sensitive actions — logins, password changes, API key operations, evidence access, exports — land in an audit log you can export from your own portal. Transport and infrastructure All traffic is served over TLS. Session cookies are HttpOnly and Secure. The free scan is passive-only (DNS, TLS, headers, email-auth records) behind SSRF guards. Scheduled vulnerability scans and phishing simulations run only after the customer signs a testing authorization for its own verified domain; penetration tests need a separately signed engagement. Daily backups run on the scheduler. Every evidence file is sealed when it is stored: a per-item SHA-256 content digest, size and time, re-checked on read, so tampering is detectable. AI use Where AI assists (policy drafting, narratives), we disclose exactly which services process what on our AI subprocessor page — the same disclosure we recommend tax firms make under Circular 230 §10.36. AI never decides a control's status; statuses come only from real signals. Reporting a vulnerability Found something? Email [email protected]. We read every report, respond to actionable ones, and will credit you if you want. Please practice responsible disclosure — give us a reasonable window before publishing. Questions and next step Security questionnaire to fill in about us? Send it to [email protected] and we will answer it from this page's facts — the same way our questionnaire-autofill answers yours. See the controls for yourself. The live demo is the real customer portal on sample data — no signup. Tour the live demo See plans and pricing Issued by DigComply Solutions Private Limited (in association with CA4CPA Global LLC). This page describes the platform as built; it is updated when the facts change. © 2026 DigComply Solutions Private Limited.